March 2018 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1082274] New: VUL-0: CVE-2017-12911: mp3gain: stack memory corruption when opening a crafted MP3 file
by bugzilla_noreply＠novell.com 05 Mar '18

05 Mar '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1082274 Bug ID: 1082274 Summary: VUL-0: CVE-2017-12911: mp3gain: stack memory corruption when opening a crafted MP3 file Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/200624/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: aloisio(a)gmx.com Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2017-12911 The "apetag.c" file in MP3Gain 1.5.2.r2 has a vulnerability which results in a stack memory corruption when opening a crafted MP3 file. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12911 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12911 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1055834] [FAILED] Failed to start Setup Virtual Console.
by bugzilla_noreply＠novell.com 05 Mar '18

05 Mar '18

http://bugzilla.suse.com/show_bug.cgi?id=1055834 http://bugzilla.suse.com/show_bug.cgi?id=1055834#c49 --- Comment #49 from Michael Vetter <mvetter(a)suse.com> --- Just wanted to confirm: I removed plymouth* and installed the latest snapshot (so getting new kernel/initrd). Problem is gone. So I guess it has something to do with plymouth. Anyways this is a more long term fix for people who don't care about the splashscreen. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1078785] Regression: VNC cannot be accessed at http://<host>:5801 during installation
by bugzilla_noreply＠novell.com 05 Mar '18

05 Mar '18

http://bugzilla.suse.com/show_bug.cgi?id=1078785 http://bugzilla.suse.com/show_bug.cgi?id=1078785#c11 Michal Srb <msrb(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|msrb(a)suse.com |knut.anderssen(a)suse.com --- Comment #11 from Michal Srb <msrb(a)suse.com> --- Reassigning to Knut since there is nothing to do from my side. To summarize, we have those options: 1) Modify YaST to remove all web-based VNC from installation. 2) Install xorg-x11-Xvnc-java to get back the Java based web client that YaST is trying to use now during installation. 3) Install xorg-x11-Xvnc-novnc to get the new javascript based web client and modify YaST to use it during installation. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1083911] New: VUL-0: CVE-2017-7651: mosquitto: Unauthenticated clients can send a crafted CONNECT packet which causes large amounts of memory use in the broker
by bugzilla_noreply＠novell.com 05 Mar '18

05 Mar '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1083911 Bug ID: 1083911 Summary: VUL-0: CVE-2017-7651: mosquitto: Unauthenticated clients can send a crafted CONNECT packet which causes large amounts of memory use in the broker Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other URL: https://smash.suse.de/issue/201129/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mrueckert(a)suse.com Reporter: kbabioch(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2017-7651 A vulnerability exists in all Mosquitto versions up to and including 1.4.14 known as CVE-2017-7651. Unauthenticated clients can send a crafted CONNECT packet which causes large amounts of memory use in the broker. If multiple clients do this, an out of memory situation can occur and the system may become unresponsive or the broker will be killed by the operating system. The issue is fixed in Mosquitto 1.4.15. Patches for older versions are available at https://mosquitto.org/files/cve/2017-7651 The fix addresses the problem by limiting the permissible size for CONNECT packet, and by adding a memory_limit configuration option that allows the broker to self limit the amount of memory it uses. Thanks to Felipe Balabanian for finding this vulnerability and responsibly reporting it. References: http://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-… http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7651 http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7651.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7651 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1080015] Mouse unusable under Wayland
by bugzilla_noreply＠novell.com 05 Mar '18

05 Mar '18

http://bugzilla.suse.com/show_bug.cgi?id=1080015 http://bugzilla.suse.com/show_bug.cgi?id=1080015#c21 --- Comment #21 from Michal Srb <msrb(a)suse.com> --- (In reply to Joerg Roedel from comment #20) > I am still seeing this problem with latest Leap 15.0 on real hardware with a > AMD Radeon GPU. The mutter in newest Leap 15.0 does not have the fix yet. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1083912] New: VUL-0: CVE-2017-7652: mosquitto: If the broker has exhausted all of its free sockets/file descriptors and then a SIGHUP signal is received to trigger reloading of the configuration, then the reloading will fail.
by bugzilla_noreply＠novell.com 05 Mar '18

05 Mar '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1083912 Bug ID: 1083912 Summary: VUL-0: CVE-2017-7652: mosquitto: If the broker has exhausted all of its free sockets/file descriptors and then a SIGHUP signal is received to trigger reloading of the configuration, then the reloading will fail. Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other URL: https://smash.suse.de/issue/201130/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mrueckert(a)suse.com Reporter: kbabioch(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2017-7652 A vulnerability exists in Mosquitto versions 1.0 to 1.4.14 inclusive known as CVE-2017-7652. If the broker has exhausted all of its free sockets/file descriptors and then a SIGHUP signal is received to trigger reloading of the configuration, then the reloading will fail. This results in many of the configuration options, including security options, being set to their default value. This means that authorisation and access control may no longer be in place. The issue is fixed in Mosquitto 1.4.15. Patches for older versions are available at https://mosquitto.org/files/cve/2017-7652 The fix addresses the problem by only copying the new configuration options to the in use configuration after a successful reload has taken place. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7652 http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7652.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7652 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1080489] Installation of Tumbleweed fails with DeviceRealDisk for Storage:Module
by bugzilla_noreply＠novell.com 05 Mar '18

05 Mar '18

http://bugzilla.suse.com/show_bug.cgi?id=1080489 http://bugzilla.suse.com/show_bug.cgi?id=1080489#c3 Ancor Gonzalez Sosa <ancor(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- URL|https://trello.com/c/35z1qz | |In | CC| |ancor(a)suse.com, | |ladislav.mate(a)gmail.com Assignee|yast-internal(a)suse.de |yast2-maintainers(a)suse.de Flags| |needinfo?(ladislav.mate@gma | |il.com) --- Comment #3 from Ancor Gonzalez Sosa <ancor(a)suse.com> --- This looks to me like a duplicate of bug#1071454. That is, update fails if /var is in a separate partition (or it's not found). So correct me if I'm wrong: you were trying to upgrade the system to Tumbleweed, not performing a full clean reinstall. Isn't it? Moving back to y2maintainers while I try to clarify the situation. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1083768] New: The program iscan / imagescan for Epson needs updating
by bugzilla_noreply＠novell.com 05 Mar '18

05 Mar '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1083768 Bug ID: 1083768 Summary: The program iscan / imagescan for Epson needs updating Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: x86-64 OS: openSUSE 42.3 Status: NEW Severity: Enhancement Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: jcarricksmith(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The iscan version in the repositories is 2.30. Version 3.36 exists (for opensuse 42.2 at least) at http://support.epson.net/linux/src/scanner/imagescanv3/opensuse/ . The 2.30 version requires an old version of libpng.so (version 12 - current version is 16). This stops the saving of .png files from the software. I have a work-around but would be glad of the latest version. Thank you John -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1083868] New: Failed to get unit file state for container-feeder.service: No such file or directory
by bugzilla_noreply＠novell.com 05 Mar '18

05 Mar '18

http://bugzilla.suse.com/show_bug.cgi?id=1083868 Bug ID: 1083868 Summary: Failed to get unit file state for container-feeder.service: No such file or directory Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kubic Assignee: kubic-bugs(a)opensuse.org Reporter: jason.evans(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 762607 --> http://bugzilla.suse.com/attachment.cgi?id=762607&action=edit Installation log Build: Snapshot20180302 Issue happened during installation. y2log attached. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1082527] caasp-container-manifests uninstallable
by bugzilla_noreply＠novell.com 05 Mar '18

05 Mar '18

http://bugzilla.suse.com/show_bug.cgi?id=1082527 http://bugzilla.suse.com/show_bug.cgi?id=1082527#c5 Richard Brown <rbrown(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jason.evans(a)suse.com --- Comment #5 from Richard Brown <rbrown(a)suse.com> --- *** Bug 1083868 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are on the CC list for the bug.

1 0